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CWAP (WI-FI ANALYSIS) Exam 
CWAP-404 Questions V8.02 
CWAP (Wi-Fi Analysis) 

Topics - Certified Wireless 
Analysis Professional 


1.Which one of the following should be the first step when troubleshooting a WLAN 
issue? 

A. Identify capture locations 

B. Identify probable causes 

C. Perform an initial WLAN scan and see if any obvious issues stand out 
D. Define the problem 

Answer: D 


2.Which one of the best following is an advantage of using display filters instead of 
capture-time filters? 

A. Display filters allow for focused analysis on just the packets of se 

B. Once created display filters are reusable for later captures 

C. Display filters only hide the packets from view and the filtered pacts can be 
enabled for view later 


rA 
D. Multiple display filters can be applied simultaneously Fa 
Answer: A of 
Explanation: ra 


display filters allow you to focus on things of interest eid to ignore things you don't 
care about. Á 

Reference: https://searchnetworking. techtarget,eémitip/How- -to-manage-Wireshark- 
display-filters e 


3.Using a portable analyzer you perigtm a packet capture next to a client STA and 
you can see that the STA is assoaiated to a BSS. You observe the STA sending 
packets to the AP and the AP pênding packets to the STA. Less the 2% of all packets 
are retransmissions. You moře to capture packets by the AP and, while the retry rate 
is still very low, you now.ghly see unidirectional traffic from the AP to the client. 

How do you explain this behavior? 

A. There is a transi power mismatch between the client and the AP and while the 
client can hear tað Aps traffic, the AP cannot hear the client. 

B. The portabl analyzer has a lower receive sensitivity than the AP and while it can’t 
capture the packets 

from the client STA, the AP can receive them OK. 

C. The STA is transmitting data using more spatial streams than the potable analyzer 
can support 

D. The portable analyzer is too close to the AP causing CCI, blinding the AP to the 
client’s packets 

Answer: B 


4.Given a protocol analyzer can decrypt WPA2-PSK data packets providing the PSK 


and SSID are configured in the analyzer software. 

When performing packet capture (in a non-FT environment) which frames are 
required in order for PSK frame decryption to be possible? 

A. Authentication 

B. Reassociation 

C. 4-Way Handshake 

D. Probe Response 

Answer: C 


5.When configuring a long term, forensic packet capture and saving all packets to 
disk which of the following is not a consideration? 


A. Total capture storage space > 
B. Individual trace file size av 
C. Real-time packet decodes £ 
D. Analyzer location E 
Answer: B $ 
ea 
Pa 


6.You are performing a multiple adapter channel agðregation capture to troubleshoot 
a VolP roaming problem and would like to meagure the roaming time from the last 
VoIP packet sent on the old AP’s channel to te first VoIP packet sent on the new 
AP’s channel. Ka 

Which timing column in the packet views#iould measure this for you? 

A. Delta S 

B. Absolute Ki 

C. Roaming se 

D. Relative v 
Answer: C 


7.Protocol analyzers may present field values in either binary, decimal or 
hexadecimal. 

What precedes a 

hexadecimal value to indicate it is hexadecimal? 

A. 0x 

B. % 

C. HEX 

D. 16x 

Answer: A 


8.Which one of the these is the most important in the WLAN troubleshooting 


methodology among those listed? 

A. Interview the network manager about the issues being experienced 

B. Talk to the end users about their experiences 

C. Observe the problem 

D. Obtain detailed knowledge of the wireless vendors debug and logging options 
Answer: C 


9.The network administrator at ABC Engineering has taken a large packet capture 
from one of their APs running in monitor mode. She has very little knowledge of 
802.11 protocols but would like to use the capture file to evaluate the overall health 
and performance of their wireless network. When she asks your advice, which tool do 


you recommend she opens the packet capture file with? a> 
A. Capture visualization tool a 
B. Protocol analyzer K 
C. Spectrum analyzer Fa 
D. WLAN scanner of 
Answer: B ra 
& 
Ko 


10.802.11k Neighbor Requests and Neighbor Beors are sent in what type of 
Management Frames? 


Ka 
A. RRM Pa 
B. Action | 
C. Beacon S 
D. Reassociation Request and Reassociation Response 
Answer: C Ba 
Pi 
KO 


11.Which one of the fafowing i is required for Wi-Fi integration in laptop-based 
Spectrum Analyzer,software? 

A. A supported witan adaptor with a customized driver 

B. Any 802.11 Wireless adaptor 

C. A dual radio spectrum analyzer card 

D. SNMP read credentials to the WLAN controller or APs 

Answer: C 


12.You’re the WLAN administrator for a large retailer based at the HQ in New York. 
The London-based office has been complaining about WLAN disconnections around 
lunch time each day. You suspect this might be interference from the staff microwave, 
how might you test your theory from the New York office? 

A. Access the microwave remotely and run a diagnostic check 


B. Ask a local member of staff to take some pictures of the microwave, including 
some close-ups of the door seal so that you can access it 

C. Place one of the London APs into spectrum analyzer mode and monitor the 
situation over lunch time 

D. Ask a local member of staff to change the frequency of the microwave and see if 
the disconnections stop 

Answer: A 


13.ABC International has installed a new smart ZigBee controlled lighting system. 
However, the network team is concerned that this new system will interface with the 
existing WLAN and has asked you to investigate the impact of the two systems 
operating simultaneously in the 2.4 GHz band. When performing Speggum Analysis, 
which question could you answer by looking at the FFT plot? ae 

A. Do the ZigBee channels used by the lightning system overlay the WLAN 
channels? 

B. Is the ZigBee system using more the 50% of the available” finime? 

C. Is the ZigBee system causing an increase in WLAN t@tties? 

D. Is the WLAN corrupting ZigBee system messages 

Answer: C © 


14.In a Spectrum Analyzer the Swept Spgetiogram plot displays what information? 
A. The RF time domain oo 

B. RF power present at a particular frequency over the course of time 

C. Wi-Fi Device information a 

D. Duty cycle in the frequency, fömain 


Answer: D S 


ę 
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15.You have installed a new 802.11ac WLAN configured with 80 MHz channels. 
Users in one ared are 

complaining about poor performance. This area is currently served by a single AP. 
You take a spectrum 

analysis capture in the poor performing areA. While examining the waterfall plot you 
notice the airtime 

utilization is higher on the first 20 MHz of the 80 MHz channel when compared to the 
rest of the channel. 

What do you conclude? 

A. The AP is misconfigured and needs to be reconfigured to 80MHz operation 

B. RRM is enabled and has dynamically picked a 20 MHz channel 

C. The first 20 MHz is the AP’s primary channel and higher airtime utilization on the 
primary channel is normal when an AP Is configured for 80 MHz operation 


D. Non Wi-Fi interference is preventing the APs 80 MHz operation 
Answer: C 


16.Which common feature of a Spectrum Analyzer would be the best to help you 
locate a non-802.11 

interference source? 

A. Max hold 

B. Location filter 

C. Waterfall plot 

D. Device finder 

Answer: D 

S 
17.A manufacturing facility has installed a new automation systeg¥which incorporates 
an 802.11 wireless network. The automation system is controla from tablet 
computers connected via the WLAN. of 

However, the automation system has not gone live due to" A with the tablets 
connecting to the WLAN. The WLAN vendor has beep’Onsite to perform a survey and 
confirmed good primary and secondary coverage goss the facility. As a CWAP you 
are called in to perform Spectrum Analysis to identify any interference sources. From 
the spectrum analysis, you did not identify agyinterference sources but were able to 
correctly identify the issue. 

Which of the following issues did you efit from the spectrum analysis? 

A. The tablets are entering power save mode and failing to wake up to receive the 
access points ae 

transmissions F 

B. A high noise floor has regited i in a SNR of less than 20% 

C. The tablets are connegting to the wrong SSID 

D. There is a power nysmatch between the APs and the clients 


Answer: A Ro 
oe 
w” 
18.Finish the statement. It is possible to distinguish between and 20 


MHz transmissions when looking at an FFT plot. 
A. HR/DSSS and ERP 

B. ERP and VHT 

C. HT and VHT 

D. OFDM and HT 

Answer: C 


19.What is the function of the PMD sub-layer? 


A. Converts 1s and Os given to it by the PLCP sub-layer into the appropriate RF 


signals 

B. Provides framing 

C. Adds a PHY preamble and header to a PSDU 
D. Performs A-MPDU 

Answer: A 


20.What is the function of the PHY Preamble? 

A. To set the modulation method for the MPDU 

B. Allows the receiver to detect and synchronize with the signal 
C. To terminate a conversation between transmitter and receiver 


D. Carries the NDP used in Transmit Beamforming and MU-MIMO a> 
Answer: B ae 
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